Personvernerklæring

This policy explains what personal data E-Invoice Map processes, why, and what your rights are under the GDPR ^[1].

Who is responsible

The controller is Mohamed (Mo) Farag, Carrer de Floridablanca 68, Local 9F, 08015 Barcelona, Spain. Contact: [email protected]. Details are in the legal notice.

What we process, and why

Data	Purpose	Legal basis	Kept for
Page statistics: counted from our web server log by our self-hosted GoatCounter, with no script in your browser: the page, the referring site, the browser type and the country	knowing which pages are useful	legitimate interest	aggregated counts; nothing is stored on your device, no profile of you. The log lines used for counting are kept 14 days, like the server log. If your browser sends Global Privacy Control or Do Not Track, the visit isn't counted
Lookup requests: the number you type is sent to the Peppol network (see below) and the answer is cached under a scrambled key. We keep no log of the numbers people look up	answering the lookup and caching	legitimate interest	the cached answer 24 hours
Rate limiting: a short-lived counter keyed on a hash of your IP address	the daily limits (20 lookups, 200 rows in a bulk check), abuse protection	legitimate interest	24 hours
Privacy requests: what you send through the form below, including your email	handling your request	legal obligation	your email and message 90 days after we close the request; then only the type, dates and a scrambled form of the identifier, blocked (nobody uses it), for up to 3 years as proof of how we answered
Reports and corrections ("Report a problem" at the bottom of each page): the page, your message, an optional source link and, only if you give it, your email	checking and fixing the site, and replying to you (a copy of each report is emailed to our mailbox at [email protected])	legitimate interest	12 months; your email is erased 90 days after we close the report
Notices of illegal content (the same form, "Illegal content"): the page, your explanation, your name and email	handling the notice under the Digital Services Act and telling you our decision	legal obligation	12 months; your name and email are erased 90 days after our decision
Clicks on provider links ("Visit" links to a provider's website): which provider, the country page, the page and the spot on it, the language and the day. No IP address, no cookie, nothing about you	knowing which pages help people choose, and reporting clicks to affiliate networks and to providers with a Featured listing	legitimate interest	daily totals, kept as statistics
Web server log: your IP address, the time, the page asked for (without query strings, so not the numbers you look up), the answer code and your browser type. Clicks on provider links are logged without the IP address	security, and finding and fixing errors	legitimate interest	14 days
Peppol participant data (sole traders included), from the public Peppol Directory and the Peppol network, not from you: the identifier, its scheme and country, its access-point provider and the dates we saw it	the lookup, daily counts and aggregated market shares	legitimate interest, see our assessment; Spanish law presumes it for sole traders' business data (LOPDGDD art. 19) [3]	while listed in the Directory and 12 months after it disappears; the result of each monthly check of a sample of identifiers 24 months; the counts and shares we publish contain no identifier

We never store names, email addresses or phone numbers of companies or people from the Peppol Directory or from official lists. We never sell data and never build profiles of visitors.

The e-invoice viewer

Files you open in the viewer are processed only in your browser. They are never uploaded, stored or seen by us.

The Peppol network and company registers

• Peppol network. To answer a lookup, our server asks the public Peppol network: a DNS query, then the company's own provider (its SMP server), exactly as a sender's e-invoicing software does. The provider sees the number and our server's address, not yours.
• Company-name search (Norway and France): if you type a company name and press "Search the register", your browser asks the official register directly (Brønnøysundregistrene in Norway, the Annuaire des Entreprises in France). We never see the name; the register sees it, with your IP address, under its own privacy notice.

Service providers

• Hosting: a server operated by Hetzner Online GmbH in Germany.
• Cloudflare, Inc. (USA): network delivery and security, the Turnstile bot check on the lookup and request forms, and forwarding of emails sent to [email protected]. Cloudflare processes technical connection data (your IP address, browser signals) on our behalf.
• Lettermint (Netherlands, EU servers): sends the emails you ask for (confirmation links and, if you have an account, login links and alerts). It receives your email address and the text of that email, does not track opens or clicks, and keeps delivery logs for 28 days.
• Google (Gmail): the mailbox behind [email protected]. Emails you send us, and our replies, are stored there. For that mailbox Google acts under its own privacy policy.

Transfers outside the EU. Cloudflare, Inc. and Google transfer data to the United States under the EU–US Data Privacy Framework, an adequacy decision of the European Commission ^[4]. If that framework stops applying, the European Commission's standard contractual clauses apply. You can ask us for a copy of the safeguards.

Your rights

You can ask for access, correction, erasure and restriction, and you can object to processing based on legitimate interest, including the display of lookup results for an identifier that relates to you as a sole trader: we then stop showing it and stop storing it, and keep only a scrambled form of the identifier so it isn't added again. You can withdraw a consent at any time (early access). We make no decisions about you by automated means. Requests are free; if we have real doubt who you are, we may ask for proof. We answer within 7 days and at the latest within one month (three months for a complex request; we tell you within the first month). You can also complain to the Spanish data protection authority (AEPD) ^[2].

What your browser stores for this site, and why no consent banner is needed, is on the cookies page.

Kontoer: oppretter du en konto eller kjøper et abonnement, forklarer personvernerklæringen for kontoer hva vi lagrer om deg, og databehandlervilkårene gjelder listene du legger til (på engelsk).

Tidlig tilgang til sending: melder du deg på tidlig tilgang til sending av e-faktura, forklarer påmeldingssiden hva vi lagrer (e-postadresse, firma, land, skatte- eller organisasjonsnummer og svarene dine) og når vi sletter det: ubekreftede påmeldinger etter 24 timer, alt annet 12 måneder etter påmelding eller når testen avsluttes.

Tjenesteforespørsler: sender du en forespørsel via siden om integrasjonshjelp, lagrer vi navnet ditt, jobb-e-posten, firmaet, landet og meldingen din. Formål: å svare deg og lage et tilbud. Behandlingsgrunnlag: tiltak på din anmodning før en avtale inngås, GDPR art. 6 nr. 1 bokstav b. Vi beholder dem i 12 måneder etter forespørselen, lenger bare hvis det blir en kontrakt. Vi bruker dem aldri til markedsføring, deler dem ikke og viser dem ikke til andre. En kopi av hver forespørsel sendes på e-post til postkassen vår på [email protected]. Vi tar ikke oppdrag fra firmaer etablert i Spania: forespørsler fra Spania avvises og lagres ikke.

Å gjøre krav på en profil: gjør du krav på profilen til en leverandør, forklarer kravsiden hva vi lagrer: domenet du bekreftet, hvordan du bekreftet det (en e-post på det domenet eller en DNS-post), tidspunktene og det du sender inn (rettelser, en beskrivelse, en logo). Vi lagrer ikke navnet eller e-postadressen din: den ene bekreftelses-e-posten går til adressen du skriver inn, og ingenting av den beholdes. Nettleserfanen din holder på et kortvarig token (2 timer), slik at en omlasting ikke får deg til å miste arbeidet. Det du sender blir først publisert etter at en person har gått gjennom det. Krav som ikke fører noen vei slettes etter 90 dager, avviste innsendinger etter 12 måneder.

Lenker merket «Annonse»: når du klikker på en, går du via affiliatenettverket som driver leverandørens partnerprogram (for eksempel Awin, Daisycon, Impact, PartnerStack eller Affilae) til leverandørens nettsted. Nettverket og leverandøren kan da sette egne informasjonskapsler på sine egne nettsteder for å kjenne igjen at du kom fra oss, slik at vi får betalt hvis du registrerer deg. Disse informasjonskapslene er deres og følger deres personvernerklæringer, som nettstedene deres lenker til. Vi forteller bare nettverket hvilken av sidene våre, og hvor på siden, lenken sto: aldri noe om deg.

Send meg denne siden: ber du oss sende deg en lenke til en side på e-post, bruker vi adressen din bare til å sende den ene e-posten og lagrer ingenting: ingen adresse, ingen liste. Vi teller hvor mange slike e-poster som sendes per dag, og en kortvarig teller (en saltet hash av adressen din, borte etter en time) hindrer misbruk.